CVE-2013-2254

EPSS 0.99%

Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Sling

發布日:2022/5/17修改日:2024/12/6

描述

The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.

受影響套件(1)

Maven/org.apache.sling:org.apache.sling.apifrom 0, < 2.4.0

參考連結(4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2013-2254
WEBhttp://mail-archives.apache.org/mod_mbox/sling-dev/201310.mbox/%3CCAKkCf4pue6PnESsP1KTdEDJm1gpkANFaK%2BvUd9mzEVT7tXL%2B3A%40mail.gmail.com%3E
WEBhttps://exchange.xforce.ibmcloud.com/vulnerabilities/87765
WEBhttps://issues.apache.org/jira/browse/SLING-2913